Rockwell Automation has closed more than a dozen vulnerabilities in software and controllers used at industrial facilities. The gravest of these flaws permit the disabling of control-system components, the execution of code on a device, or the acquisition of SYSTEM privileges in Windows. The problems therefore afflict not merely engineers' workstations, but also equipment directly engaged in governing production processes.

Rockwell Automation has issued patches and workarounds for more than a dozen vulnerabilities across its industrial automation products, including critical and high-severity flaws in RSLinx Classic, ControlLogix, CompactLogix, and other tools. The advisories cover denial-of-service, remote code execution, privilege escalation, and cross-site scripting issues, with CISA also publishing guidance for CVE-2026-9637....

The RSLinx Classic software that connects your control devices can stop working if it receives a specially formed network packet.

U.S. security agencies issue an alert regarding AI-driven cyber threats targeting Siemens industrial controllers operating critical water, energy, and manufacturing facilities.

A new Forescout scan found more than 4,000 Rockwell Automation and Allen-Bradley controllers exposed on the internet, with 22 still visible in cities affected by recent attacks on U.S. water systems. The research highlights ongoing risks from public-facing EtherNet/IP devices, stale remote-access services, and possible exposure to CVE-2017-16740 on some MicroLogix 1400 systems. #RockwellAutomation #AllenBradley #MicroLogix1400 #CVE-2017-16740

Forescout found 22 internet-facing Rockwell Automation programmable logic controllers (PLCs) in cities hit by recent cyberattacks on US water utilities. Nineteen used the same mobile carrier network. Its August 3 scan counted 4,407 exposed Rockwell controllers worldwide, including 2,844 in the United States, but Forescout could not confirm any were compromised. That figure counts exposed

CISA is warning that internet-exposed PLCs in water and wastewater systems are being increasingly targeted, with recent attacks disrupting more than 30 Minnesota community water systems. The agency says attackers have changed passwords, altered IP settings, and exploited exposed OT assets, while advising organizations to remove direct internet exposure and secure access through VPNs or gateways. #CISA #Minnesota #RockwellAutomation #AllenBradley #Siemens #SchneiderElectric #MicroLogix1400

TL;DR Attackers are hijacking internet-exposed MicroLogix 1400 controllers at U.S. water utilities. They change device IP addresses and set unknown passwords, so operators lose their view of equipment. Rockwell Automation published recovery guidance, and the FBI confirms the MicroLogix 1400 attacks are active. Why it matters Water and wastewater plants rely on these controllers for daily operation. When a controller locks out its operator, monitoring and control can stop.

Rockwell Automation has patched four high-severity vulnerabilities in Arena Simulation that could allow arbitrary code execution if a user opens a malicious file. The flaws affect Arena versions up to 17.00.00 and are tracked as CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, and CVE-2026-8314. #RockwellAutomation #ArenaSimulation #CVE-2026-8085 #CVE-2026-8312 #CVE-2026-8313 #CVE-2026-8314...

Rockwell Automation has issued patches for high-severity vulnerabilities in Arena Simulation software, exposing critical process failures to secure